Intrusion techniques (commonly termed “hacking”) present security threats, often dangerous, to computer systems and data. The danger increases in network systems that rely on interconnectivity. Thus, today's network systems generally employ intrusion management technologies to make their networks more defensible to attacks. Two types of network-based intrusion management technologies are known in the art: intrusion detection systems (IDS) and intrusion prevention systems (IPS).
IDS-based systems are typically standalone appliances designed to look for signs of intrusions in network traffic and generate security alarms accordingly. They rely on hard coded threat values and human expertise in analyzing threats, which can be in the hundreds or even thousands. One significant problem with the hard coded threat values approach is that it typically only considers how dangerous an attack itself is and ignores an enormous amount of information that can dramatically impact the true level of the security threat. For example, the criticality or value of a system or business asset that is being targeted by an attack may determine whether an action needs to be taken and whether a priority relevant to the action may apply. Another problem is that because it only considers how dangerous an attack itself is based on hard coded threat values, it does not discriminate threats against individual systems. As one skilled in the art may appreciate, some threats that are dangerous for one network system (i.e., may cause damages) may not impose a real world threat to another network system. For example, a UNIX®-based system may be immune to a Windows®-based attack, so no actions may be necessary.
IDS-based systems typically have no prior network knowledge or target awareness. To determine whether a network is being targeted by and subject to damage from a particular threat, many network systems rely on human experts (i.e., security administrators or analysts) to investigate and analyze security alarms on a manual and ad-hoc basis. The accuracy and effectiveness of a threat analysis may vary from system to system and depend on the particular knowledge and abilities of individual human experts. Moreover, an IDS-based system may continuously generating hundreds and hundreds of security alarms that must be reviewed by security administrators or analysts 24 hours a day, seven days a week. In some cases, due to the complexity and perhaps the number of threats involved, it may not be viable or even possible to review all security alarms and perform threat analyses accordingly in a timely manner.
To address some of the drawbacks of IDS-based systems, some prior efforts offered inline intrusion prevention systems (IPS) that attempt to block attacks before reaching their targets. Like the IDS, IPS-based systems also typically utilize hard-coded threat values. Typically, the actual threat value in most existing IPS-based systems is a hard-coded value associated with an attack type (e.g., “low”, “med”, or “high”). In other words, threats are ranked by type for human review and are not scored based on their real ability to intrude a particular network and/or to cause damages. Typically, each hard coded threat value is associated with an event type or a specific event. The meaning of the term “event” may vary from system to system, dependent upon each system's underlying technology. Currently, there are the two primary technologies for network-based intrusion detection and prevention systems. The first is commonly referred to as “signature-based”, where a signature defines both the meaning of an event (e.g., an attempt to exploit a vulnerability, a list of reference items, etc.) and a set of patterns by which to identify such an event on a network (e.g., a string of text to be found in the payload of a TCP packet). The second is commonly referred to as “anomaly-based”, wherein events are represented as deviations from normal behavior, and usually have no indication of a specific attack or any pre-defined patterns to match in network content.
Prior network-based intrusion detection and prevention systems (IDS and IPS) are affected by the same problems and have the same fundamental limitations. For example, accuracy in actual threat detection is low and false positives often result in a denial of network service to valid customers. Consequently, in real world deployments, the majority of network intrusion detection and prevention systems operate passively without filtering a single packet, which means that most of the security alarms must still be analyzed by human experts (i.e., security administers or analysts) using the same tedious manual process.
Another limitation is that these existing network intrusion detection and prevention systems are designed to make binary (e.g., true/false or yes/no) decisions about each potential threat based on a limited number of pre-coded questions (e.g., 1-10 questions). If the first answer happens to be false, the decision process stops and ignores the rest of the questions, making a quick exit out of a binary decision tree. Due to the binary nature of this decision making process, relevant or event critical information may not be asked and/or taken into consideration in determining the relevance and/or severity of a security threat. As a result, having a wrong answer early on in the decision tree may compromise the security of the system. For example, a security system may detect an event which may target a particular host. The system checks the list of hosts and decides that the event can be dropped because the target host is not on the list. Unbeknownst to the system, the list of hosts does not include a newly installed server, which happens to be just what that particular event targets. Thus, the answer to the first question (i.e., “does this event target any host known by the system?”) was a wrong answer and the new server is exposed and vulnerable to that particular attack.
Yet another limitation is that these existing network intrusion detection and prevention systems are designed to be fast and efficient, producing no noticeable degradation to network performance. Consequently, they cannot perform the following tasks in real time:    1) Take the necessary time to learn the protected network;    2) Make complex decisions about attacks that may span more than a limited number of packets;    3) View intrusions as event scenarios;    4) Correlate attack and vulnerability information;    5) Detect attacks involving numerous steps or network sessions; and    6) Handle spatially and temporally distributed attacks.
A need exists for a more complete intrusion detection solution to defensible networks that can provide a real-time correlation, ongoing vulnerability discovery, and active intrusion defense, automating the reasoning process performed by human security experts. Embodiments of the present invention address this need and more.